The only answer is WebDRM.

It's easy to pretend you're human, it's hard to pretend that you have a valid cryptographic signature for Google which attests that your hardware is Google-approved.

Crawling is the price we pay for the web's openness.

It's not hard to bypass attestation, it's actually very easy and done right now, there's giant click farms with phones on racks.

They don't modify any device and will pass whatever attestation you try to make.